Security policy

Our security policy aims to protect sensitive company and customer data, prevent unauthorized access, ensure traceability of actions and guarantee regulatory compliance, particularly with Canadian requirements. It is a living, evolving document.

Wherever possible, we favor hosting information in a data center located in Canada. Data identified as sensitive by our customers is always stored and processed exclusively in Canada.

Access Management and Authentication

Fundamental principles

Principle of least privilege: Each user has access only to the resources required for his or her tasks.
Multifactor authentication (2FA) mandatory on all services where available (in progress)
Exclusive use of nominative accounts (shared accounts are prohibited, with approved exceptions)
Strict separation of environments (development, staging, production)

Communications & Infrastructure Security

Data encryption

HTTPS communications mandatory for all web services with valid SSL certificates
Cloudflare as the leading security solution for protecting and optimizing web services
Mandatory encryption of data at rest and in transit

Secret management

Strict ban on storing secrets in source code or on workstations
Use ofwell-known secret management tools (GitHub Secrets, 1Password, dedicated cloud services)